近來網路技術迅速的發展，工業所使用之控制系統以及物聯網設備都快速的成長
中，這樣的發展帶來科技進步但同樣的也面臨越來越多樣的問題。過去幾年中常發生
關鍵基礎設施被攻擊之案例，顯見針對工業控制系統之防禦方法仍不夠完整。而在工
業控制系統中，其最主要的防禦方法為設置蜜罐，但現今常用的工業控制系統蜜罐皆
只針對部分內容模擬，其真實性不足。為解決上述問題，本研究將說明工業控制中常
用的通訊協定，並且將研究重點放在廣泛應用的Modbus協定，透過分析工業控制系
統設備之Modbus通訊行為，了解工業控制系統設備的通訊特徵，並且在後續提出一
方法改變裝置之通訊行為，針對個別裝置進行調整以達到模擬工業控制設備的目的，
透過研究通訊行為與模擬機制，我們可以將現有的裝置模擬能力進一步加強，此研究
可讓捕捉駭客行為的陷阱系統更為真實，使其不易被駭客識破，誘使駭客攻擊陷阱系
統。本研究在分析裝置時使用回應行為判斷各設備之獨有特徵，並將此分析結果統整
成模型描述檔，接著藉由客製化之通訊軟體匯入描述檔並調整其特徵，最終實現在通
訊時改變其回應行為之通訊模組，本研究之評估透過Kolmogorov-Smirnov檢定其回應
特徵，而檢定結果也顯示其行為模擬的可行性，並且在模擬成果上有不錯的表現。

Due to the increase of the threat on ICS, protection on the ICS becomes more important. The cyberattack cases of ICS in recent years show that the protection mechanism on the ICS is still weak. More and more research focuses on the honeypot, which is the most used defense method in ICS. Most of the research only focuses on the content simulation, but it is not enough. Some research has shown that different devices will have different behavior when there are communicate. In other words, we can analyze their behavior to recognize whether the device is a honeypot. There is a commonly used honeypot called Conpot. Conpot implements the content simulation of ICS devices, but it does not emulate the behavior of the devices. Also, most of the user does not change the default configuration in Conpot, making the device search engine like Shodan identify it as a honeypot. In our research, we decide to propose a mechanism that can analyze the communication feature of Modbus on ICS devices and then create a configuration file for each device. We also propose a system that can utilize the configuration file and have a great performance in imitating the behavior of specific ICS devices. With our mechanism, we can provide a behavior emulation method for honeypots. Improve the reality of the honeypot.

[1] K. E. Hemsley, R. E. Fisher, History of Industrial Control System Cyber Incidents, Idaho National Laboratory, 2018.
[2] A. Daneels, W. Salter, “WHAT IS SCADA?,” 7th International Conference on Accelerator and Large Experimental Physics Control Systems, Trieste, Italy, 4-8 Oct., 1999.
[3] FBI, CISA, EPA, MS-ISAC, “Compromise of U.S. Water Treatment Facility,” 2021. [Online]. Available: https://us-cert.cisa.gov/sites/default/files/publications/AA21-042A_Joint_Cybersecurity_Advisory_Compromise_of_U.S._Drinking_Treatment_Facility.pdf. [Accessed 10 7 2021].
[4] L. Spitzner, Honeypots: Tracking Hackers, Addison-Wesley Longman Publishing Co., Inc., 2002.
[5] MushMush Foundation, “Conpot Documentation Release 0.6.0,” MushMush Foundation, Sankt Pölten, 2019.
[6] Shodan, “What is Shodan?,” Shodan, 2021. [Online]. Available: https://help.shodan.io/the-basics/what-is-shodan. [Accessed 26 Apr 2021].
[7] J. P. Disso, K. Jones, S. Bailey, “A Plausible Solution to SCADA Security Honeypot Systems,” 2013 Eighth International Conference on Broadband and Wireless Computing, Communication and Applications, NW Washington, DC, USA, 28-30 Oct., 2013.
[8] 國家資通安全辦公室 國家安全會議, 國家資通安全戰略報告 - 資安即國安, 臺北市: 國家安全會議, 2018.
[9] K. L. Lueth, “State of the IoT 2020: 12 billion IoT connections,” IoT Analytics GmbH, 2020. [Online]. Available: https://iot-analytics.com/state-of-the-iot-2020-12-billion-iot-connections-surpassing-non-iot-for-the-first-time/. [Accessed 12 5 2021].
[10] Information Sciences Institute University of Southern California, INTERNET PROTOCOL, IETF, 1981.
[11] S. E. Deering, R. M. Hinden, Internet Protocol, Version 6 (IPv6) Specification, IETF, 1998.
[12] Google, “Google IPv6,” Google, 2021. [Online]. Available: https://www.google.com/intl/en/ipv6/statistics.html. [Accessed 26 5 2021].
[13] Information Sciences Institute University of Southern California, TRANSMISSION CONTROL PROTOCOL, IETF, 1981.
[14] J. Postel, User Datagram Protocol, IETF, 1980.
[15] F. Le, J. Ortiz, D. Verma, D. Kandlur, “Policy-Based Identification of IoT Devices’ Vendor and Type by DNS Traffic Analysis,” Policy-Based Autonomic Data Governance, pp. 180 - 201, 2019.
[16] H. Kawai, S. Ata, N. Nakamura, I. Oka, “Identification of communication devices from analysis of traffic patterns,” 2017 13th International Conference on Network and Service Management (CNSM '17), Tokyo, Japa, 26-30 Nov., 2017.
[17] M. A. Hearst, S. T. Dumais, E. Osuna, J. Platt, B. Scholkopf, “Support vector machines,” IEEE Intelligent Systems and their Applications, vol. 13, no. 4, pp. 18-28, 1998.
[18] Y. Meidan, M. Bohadana, A. Shabtai, J. D.Guarnizo, M. Ochoa, N. O. Tippenhauer, Y. Elovici, “ProfilIoT: A Machine Learning Approach for IoT Device Identification Based on Network Traffic Analysis,” SAC 2017: Symposium on Applied Computing (SAC '17), Marrakech, Morocco, 4-6 Apr., 2017.
[19] O. Salman, I. H. Elhajj, A. Chehab, A. Kayssi, “A machine learning based framework for IoT device identification and abnormal traffic detection,” Transactions on Emerging Telecommunications Technologies, p. e3743, 2019.
[20] Z. Durumeric, D. Adrian, A. Mirian, M. Bailey, J. A. Halderman, “A Search Engine Backed by Internet-Wide Scanning,” CCS '15: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, CO, USA, 12-16 Oct., 2015.
[21] Coalition Inc., “About Us,” [Online]. Available: https://www.binaryedge.io/about.html. [Accessed 2 6 2021].
[22] J. Matherly, “Happy 10-Year Anniversary!,” 2019. [Online]. Available: https://blog.shodan.io/happy-10-year-anniversary/. [Accessed 2 6 2021].
[23] M. Wang, J. Santillan, F. Kuipers, “ThingPot: an interactive Internet-of-Things honeypot,” 2018. [Online]. Available: https://arxiv.org/pdf/1807.04114v1.pdf. [Accessed 25 5 2021].
[24] M. A. Hakim, H. Aksu, A. S. Uluagac, K. Akkaya, “U-PoT: A Honeypot Framework for UPnP-Based IoT Devices,” 2018 IEEE 37th International Performance Computing and Communications Conference (IPCCC '18), Orlando, FL, USA, 17-19 Nov., 2018.
[25] J. Hieb, “Anomaly based intrusion detection for network monitoring using,” University of Louisville Master's Thesis, Louisville, KY, USA, 10 Nov., 2004.
[26] V. Pothamsetty, M. Franz, “SCADA HoneyNet Project: Building Honeypots for Industrial Networks,” Critical Infrastructure Assurance Group(CIAG) Cisco Systems, Inc., 2005. [Online]. Available: http://scadahoneynet.sourceforge.net. [Accessed 25 5 2021].
[27] The Honeynet Project, “The Honeynet Project,” The Honeynet Project, 2021. [Online]. Available: https://www.honeynet.org. [Accessed 25 5 2021].
[28] L. Rist, “Introducing Conpot,” The Honeynet Project, 2013. [Online]. Available: https://www.honeynet.org/2013/05/11/introducing-conpot/. [Accessed 25 5 2021].
[29] D. I. Buza, F. Juhász, G. Miru, M. Félegyházi, T. Holczer, “CryPLH: Protecting Smart Energy Systems from Targeted Attacks with a PLC Honeypot,” Smart Grid Security, pp. 181-192, 2014.
[30] K. Kołtyś, R. Gajewski, “SHaPe: A Honeypot for Electric Power Substation,” Journal of Telecommunications and Information Technology, pp. 37-43, 2015.
[31] Modbus Organization, “About Modbus Organization,” 2021. [Online]. Available: https://www.modbus.org/about_us.php. [Accessed 3 6 2021].
[32] Interact Analysis, “Who Were the Leading Vendors of Industrial Controls in 2017?,” 2021. [Online]. Available: https://www.interactanalysis.com/who-were-the-leading-vendors-of-industrial-controls-plcs-and-dcs-in-2017/. [Accessed 3 6 2021].
[33] J. Postel, “INTERNET CONTROL MESSAGE PROTOCOL,” IETF, 1981.
[34] Siemens, “SIMATIC S7-1200,” 2021. [Online]. Available: https://new.siemens.com/global/en/products/automation/systems/industrial/plc/s7-1200.html. [Accessed 23 6 2021].
[35] Schneider Electric, “TWDLCAE40DRF,” 2021. [Online]. Available: https://www.se.com/ww/en/product/TWDLCAE40DRF/compact-plc-base-twido---100..240-v-ac-supply---24-i-24-v-dc---16-o/. [Accessed 23 6 2021].
[36] Mitsubishi Electric Corporation, “FX5U-64MR/ES,” 2021. [Online]. Available: https://www.mitsubishielectric.co.jp/fa/products/faspec/point.do?kisyu=/plcf&formNm=610058503. [Accessed 23 6 2021].
[37] Mitsubishi Electric Corporation, “FX5U-32MR/ES,” 2021. [Online]. Available: https://www.mitsubishielectric.co.jp/fa/products/faspec/point.do?kisyu=/plcf&formNm=610058500. [Accessed 23 6 2021].
[38] ICP DAS CO., LTD., “WP-8428-CE7,” 2020. [Online]. Available: https://www.icpdas.com/en/product/WP-8428-CE7. [Accessed 23 6 2021].
[39] 賴佳俊, 劉奕賢, 吳其哲, 劉川綱, 李忠憲, “運用回應特徵的密網偵測機制,” Cryptology and Information Security Conference 2020 (CISC '20), 高雄市, 臺灣, 12-16 十月., 2020.
[40] C. C. Lai, I H. Liu, C. C. Wu, C. G. Liu, J. S. Li, “A Communication System with Equipment's Characteristics,” International Conference on Artificial Life and Robotics 2021 (ICAROB '21), Hiroshima, Japan, 21-24 Jan., 2021.